Kaspersky published research on November 2, 2026 showing that several Intelbras home Wi-Fi cameras accepted firmware update requests from anyone on the local network, without a password and without checking the file. Each request rebooted the camera and took it offline for about a minute. Sent in a loop, the requests kept it offline for as long as the attacker wanted. Intelbras has fixed the bug in firmware R.260804.

Intelbras is a large Brazilian brand, so most owners are in Latin America. The bug is still a good example of a problem that turns up across cheap cameras.

What was wrong

Kaspersky's GReAT team tested an Intelbras iM3 C (iM3B-C), a Full HD Wi-Fi camera sold for home monitoring and as a baby monitor, on firmware v240927, the newest version at the time. According to the Securelist write-up, the update endpoint /firmwareUpgrade_service/Demo took a POST with any file. The camera did not ask for a session, did not validate the firmware image, and simply started the update routine, which ends in a reboot.

Nobody gets a shell or a view of the video this way. It is a denial-of-service bug, rated medium severity. For a security camera that is still serious: an intruder who can join the Wi-Fi can blind the camera before walking past it, and the recording simply has a gap.

Intelbras says the same firmware also runs on the iMX C, iM4 C, iM5 SC, iME 360 C and iM7+ FC. The Intelbras Mibo Smart app used to set up these cameras has more than four million downloads. Securelist lists the issue under candidate ID CAN-2026-2035970. No final CVE number was given.

The fix

Firmware R.260804 requires an authenticated session before it accepts an update. Intelbras publishes update instructions, including a procedure that uses an SD card.

What to take from it

If you own one of the listed models, update now. For any other camera, the advice is the usual one, and this case shows why it matters:

  • Put cameras and other smart devices on a separate network or VLAN, away from phones and laptops, and use a strong Wi-Fi password.
  • Turn off WPS on the router. Its eight-digit PIN can be brute-forced.
  • Do not treat a camera on Wi-Fi as a guaranteed recording. If the video matters, look for systems that alert you when a camera drops off the network, for example an availability automation in Home Assistant.